vulnwire
7.1high

CVE-2017-12154

The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-s…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
7.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 44%
Public exploits
0
none known

The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allows KVM L2 guest OS users to obtain read and write access to the hardware CR8 register.

Exploit prediction (EPSS)

0.51% probability of exploitation in the next 30 days, higher than 44% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.1CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD2.03.6AV:L/AC:L/Au:N/C:P/I:P/A:N

Affected products

  • n/a Linux kernel through 4.13.3

Classification

Technology feeds
Linux kernel (RSS, critical only)

References

  • git.kernel.org /cgit/linux/kernel/git/torvalds/linux.git/commit/?id=51aa68e7d57e3217192d88ce90fd5b8ef29ec · x_refsource_CONFIRM, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=1491224 · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2018:1062 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securityfocus.com /bid/100856 · vdb-entry, x_refsource_BID, x_transferred
  • debian.org /security/2017/dsa-3981 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • spinics.net /lists/kvm/msg155414.html · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2018:0676 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • usn.ubuntu.com /3698-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • github.com /torvalds/linux/commit/51aa68e7d57e3217192d88ce90fd5b8ef29ec94f · x_refsource_CONFIRM, x_transferred
  • usn.ubuntu.com /3698-2/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
  • access.redhat.com /errata/RHSA-2019:1946 · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.